git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #850 from grnhse/is-834-userinfo-expansion

Add User & Groups to Userinfo

commit2706909fe3fb0703d97f82e6efa8e191e138ed7d authorJoel Speed <Joel.speed@hotmail.co.uk> dateFri 27 Nov 2020, 16:36 (6 years ago) parent3ff0c237407fbd
3 files changed+67−13
CHANGELOG.md+1 oauthproxy.go+8−2 oauthproxy_test.go+58−11
CHANGELOG.md+1
@@ -55,6 +55,7 @@
5555- [#797](https://github.com/oauth2-proxy/oauth2-proxy/pull/797) Create universal Authorization behavior across providers (@NickMeves)
5656- [#898](https://github.com/oauth2-proxy/oauth2-proxy/pull/898) Migrate documentation to Docusaurus (@JoelSpeed)
5757- [#754](https://github.com/oauth2-proxy/oauth2-proxy/pull/754) Azure token refresh (@codablock)
58+- [#850](https://github.com/oauth2-proxy/oauth2-proxy/pull/850) Increase session fields in `/oauth2/userinfo` endpoint (@NickMeves)
5859- [#825](https://github.com/oauth2-proxy/oauth2-proxy/pull/825) Fix code coverage reporting on GitHub actions(@JoelSpeed)
5960- [#796](https://github.com/oauth2-proxy/oauth2-proxy/pull/796) Deprecate GetUserName & GetEmailAdress for EnrichSessionState (@NickMeves)
6061- [#705](https://github.com/oauth2-proxy/oauth2-proxy/pull/705) Add generic Header injectors for upstream request and response headers (@JoelSpeed)
oauthproxy.go+8−2
@@ -798,13 +798,19 @@ func (p *OAuthProxy) UserInfo(rw http.ResponseWriter, req *http.Request) {
798798 http.Error(rw, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
799799 return
800800 }
801+
801802 userInfo := struct {
802− Email string `json:"email"`
803− PreferredUsername string `json:"preferredUsername,omitempty"`
803+ User string `json:"user"`
804+ Email string `json:"email"`
805+ Groups []string `json:"groups,omitempty"`
806+ PreferredUsername string `json:"preferredUsername,omitempty"`
804807 }{
808+ User: session.User,
805809 Email: session.Email,
810+ Groups: session.Groups,
806811 PreferredUsername: session.PreferredUsername,
807812 }
813+
808814 rw.Header().Set("Content-Type", "application/json")
809815 rw.WriteHeader(http.StatusOK)
810816 err = json.NewEncoder(rw).Encode(userInfo)
oauthproxy_test.go+58−11
@@ -1124,20 +1124,67 @@ func NewUserInfoEndpointTest() (*ProcessCookieTest, error) {
11241124}
11251125
11261126func TestUserInfoEndpointAccepted(t *testing.T) {
1127− test, err := NewUserInfoEndpointTest()
1128− if err != nil {
1129− t.Fatal(err)
1127+ testCases := []struct {
1128+ name string
1129+ session *sessions.SessionState
1130+ expectedResponse string
1131+ }{
1132+ {
1133+ name: "Full session",
1134+ session: &sessions.SessionState{
1135+ User: "john.doe",
1136+ Email: "john.doe@example.com",
1137+ Groups: []string{"example", "groups"},
1138+ AccessToken: "my_access_token",
1139+ },
1140+ expectedResponse: "{\"user\":\"john.doe\",\"email\":\"john.doe@example.com\",\"groups\":[\"example\",\"groups\"]}\n",
1141+ },
1142+ {
1143+ name: "Minimal session",
1144+ session: &sessions.SessionState{
1145+ User: "john.doe",
1146+ Email: "john.doe@example.com",
1147+ Groups: []string{"example", "groups"},
1148+ },
1149+ expectedResponse: "{\"user\":\"john.doe\",\"email\":\"john.doe@example.com\",\"groups\":[\"example\",\"groups\"]}\n",
1150+ },
1151+ {
1152+ name: "No groups",
1153+ session: &sessions.SessionState{
1154+ User: "john.doe",
1155+ Email: "john.doe@example.com",
1156+ AccessToken: "my_access_token",
1157+ },
1158+ expectedResponse: "{\"user\":\"john.doe\",\"email\":\"john.doe@example.com\"}\n",
1159+ },
1160+ {
1161+ name: "With Preferred Username",
1162+ session: &sessions.SessionState{
1163+ User: "john.doe",
1164+ PreferredUsername: "john",
1165+ Email: "john.doe@example.com",
1166+ Groups: []string{"example", "groups"},
1167+ AccessToken: "my_access_token",
1168+ },
1169+ expectedResponse: "{\"user\":\"john.doe\",\"email\":\"john.doe@example.com\",\"groups\":[\"example\",\"groups\"],\"preferredUsername\":\"john\"}\n",
1170+ },
11301171 }
11311172
1132− startSession := &sessions.SessionState{
1133− Email: "john.doe@example.com", AccessToken: "my_access_token"}
1134− err = test.SaveSession(startSession)
1135− assert.NoError(t, err)
1173+ for _, tc := range testCases {
1174+ t.Run(tc.name, func(t *testing.T) {
1175+ test, err := NewUserInfoEndpointTest()
1176+ if err != nil {
1177+ t.Fatal(err)
1178+ }
1179+ err = test.SaveSession(tc.session)
1180+ assert.NoError(t, err)
11361181
1137− test.proxy.ServeHTTP(test.rw, test.req)
1138− assert.Equal(t, http.StatusOK, test.rw.Code)
1139− bodyBytes, _ := ioutil.ReadAll(test.rw.Body)
1140− assert.Equal(t, "{\"email\":\"john.doe@example.com\"}\n", string(bodyBytes))
1182+ test.proxy.ServeHTTP(test.rw, test.req)
1183+ assert.Equal(t, http.StatusOK, test.rw.Code)
1184+ bodyBytes, _ := ioutil.ReadAll(test.rw.Body)
1185+ assert.Equal(t, tc.expectedResponse, string(bodyBytes))
1186+ })
1187+ }
11411188}
11421189
11431190func TestUserInfoEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {